About PFX™
We engineer leading fluid solutions that keep the world moving and we’re building a better future while we do it. As a vertically integrated global powerhouse, we operate 17 manufacturing facilities and 4 R&D centers across the world, delivering performance from lab to road in over 40 countries.
PFX Group™ brings together a family of trusted companies including Recochem, Prestone, Adam’s Polishes, Kost USA, Ultra Clear, POR and Auto-Chem, each with deep expertise, regional insight, and a shared commitment to engineering excellence.
From automotive and heavy-duty thermal management systems to household and industrial solutions, our products are built for performance, reliability, and a commitment to sustainability. Join us and be part of a team that’s redefining what’s possible in fluid technology.
Role Overview
The Mid-Level Cybersecurity Analyst owns the detect-to-respond lifecycle across our hybrid estate (Azure, Microsoft 365, on-prem). You will hunt, investigate and eradicate threats; engineer new controls mapped to MITRE ATT&CK® and the Cyber Kill Chain®; operationalize threat intelligence (STIX/TAXII); drive vulnerability and risk assessments; strengthen email-security defences; and mentor junior analysts while partnering with Infrastructure, Cloud, DevOps and OT teams.
Key Responsibilities

Threat Hunting, Threat Intelligence & Detection Engineering

• Develop and tune Microsoft Sentinel analytic rules, KQL hunts and SOAR playbooks aligned to ATT&CK tactics (e.g., Initial Access, Defense Evasion).
• Build and curate Microsoft Sentinel dashboards that surface real-time security metrics and convert them into clear, executive-ready visuals.
• Ingest and curate feeds via STIX/TAXII; enrich events with IOCs, TTPs and campaign data; convert intelligence into new detections and weekly threat-intel digests.
• Maintain a detection-coverage matrix and continuously reduce false-positive rates.

Incident Response & Forensics

• Lead Tier 2/3 response using NIST 800-61 playbooks, documenting each Kill-Chain phase.
• Contain, eradicate and recover across Azure, M365 and on-prem assets; preserve evidence and deliver root-cause analyses within 48 hours.

Vulnerability & Risk Assessments

• Schedule and execute vulnerability scans, penetration tests and configuration reviews; correlate CVEs with ATT&CK techniques; track remediation to closure.
• Perform formal risk assessments on new projects, third-party integrations and legacy systems; present clear risk treatment plans to stakeholders.

Email Security & Anti-Phishing

• Manage Microsoft Defender for Office 365 policies (Safe Links, Safe Attachments, anti-phishing, DMARC, DKIM, SPF).
• Analyze phishing simulations and real-world campaigns; adjust detection heuristics and user-awareness training materials.
• Triage and examine complex quarantined e-mails; extract IOCs, determine threat origin, and escalate investigations when warranted.

Cloud & Identity Security

• Harden Azure resources (VNETs, NSGs, Azure Firewall, Defender for Cloud), enforce Conditional Access, MFA and Privileged Identity Management.
• Investigate anomalous sign-ins (token replay, MFA fatigue, impossible travel) and automate containment.

Device & Network Engineering

• Audit Fortinet firewalls, switches and VPNs (FortiGate, FortiAnalyzer, FortiManager).

Automation & Continuous Improvement

• Write PowerShell/Python scripts or Sentinel Logic Apps to automate enrichment (WHOIS, VirusTotal), containment and ticket creation.
• Integrate security scanning into CI/CD (Terraform/Bicep).

Governance & Compliance

• Align and implement controls to ISO 27001, NIST CSF, and CIS Controls v8, gathering audit evidence for SOC 2, GDPR, and PIPEDA compliance.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 3 to 5 years in security operations, incident response or threat-hunting roles.
• Hands-on expertise with Fortinet security platforms, Microsoft Sentinel, Microsoft Defender and Azure security controls.
• Proven experience operationalizing threat-intel feeds (STIX/TAXII) and performing vulnerability and risk assessments.
• Advanced scripting and data-query skills with PowerShell, Python, and Kusto Query Language (KQL).
• Excellent English communication skills; French is an asset.
• Certifications such as SC-200, CySA+, GCIA, GCIH, CISSP, CEH, OSCP, CISM.
• Experience building SOAR playbooks, Terraform/Bicep security modules or securing OT/ICS environments.
• Familiarity with privacy regulations (GDPR, PIPEDA, Quebec Law 25)
• Strong proficiency in English; bilingualism is an asset.

Please refer the Job description for details